favorable-palette-833396[.]framer[.]app

Analysis indicates that the domain favorable-palette-833396.framer.app was registered through the Framer platform and is presently taken offline. The site resolved to the Amazon-owned IP address 31.43.160.6, which is assigned to ASN 16509 in the Netherlands. The TLS certificate was issued by Let’s Encrypt (identifier YE1), confirming that HTTPS was available before the site returned a 404 HTTP status. The page title observed during scanning was “Xfinity Sign In,” aligning with the classified scam type of credential phishing targeting Xfinity customers.

VirusTotal recorded 15 detections out of 91 scanners, and the domain appears on one external blocklist, with PhishDestroy already listing it as blocked. Automated infrastructure profiling identified the use of Framer Sites, React, HTTP Strict Transport Security, and HTTP/3, consistent with the hosting environment provided by Framer. Nameserver queries returned NS_NOT_FOUND, suggesting that standard DNS delegation details are unavailable or obscured.

The available evidence confirms that the domain was leveraged to harvest credentials, but the exact phishing page content and any associated payloads have not been captured, leaving the visual and functional aspects of the lure uncertain. Defenders should continue to block the domain at network perimeter and DNS resolvers, add the associated IP address to reputation feeds, and monitor for other Framer‑hosted subdomains exhibiting similar characteristics. Continuous re‑scanning of the domain is advisable in case it is re‑activated, and any future detections should be correlated with the observed SSL fingerprint and page title to improve detection accuracy.